{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/github/main/json-schema/github-audit-log-event-schema.json",
  "title": "audit-log-event",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/github-enterprise-admin-api-openapi.yml#/components/schemas/audit-log-event",
  "type": "object",
  "properties": {
    "@timestamp": {
      "type": "integer",
      "description": "The time the audit log event occurred, given as a [Unix timestamp](http://en.wikipedia.org/wiki/Unix_time)."
    },
    "action": {
      "type": "string",
      "description": "The name of the action that was performed, for example `user.login` or `repo.create`."
    },
    "active": {
      "type": "boolean"
    },
    "active_was": {
      "type": "boolean"
    },
    "actor": {
      "type": "string",
      "description": "The actor who performed the action."
    },
    "actor_id": {
      "type": "integer",
      "description": "The id of the actor who performed the action."
    },
    "actor_location": {
      "type": "object",
      "properties": {
        "country_name": {
          "type": "string"
        }
      }
    },
    "data": {
      "type": "object",
      "additionalProperties": true
    },
    "org_id": {
      "type": "integer"
    },
    "user_id": {
      "type": "integer"
    },
    "business_id": {
      "type": "integer"
    },
    "blocked_user": {
      "type": "string",
      "description": "The username of the account being blocked."
    },
    "business": {
      "type": "string"
    },
    "config": {
      "type": "array",
      "items": {
        "type": "object"
      }
    },
    "config_was": {
      "type": "array",
      "items": {
        "type": "object"
      }
    },
    "content_type": {
      "type": "string"
    },
    "operation_type": {
      "type": "string"
    },
    "created_at": {
      "type": "integer",
      "description": "The time the audit log event was recorded, given as a [Unix timestamp](http://en.wikipedia.org/wiki/Unix_time)."
    },
    "deploy_key_fingerprint": {
      "type": "string"
    },
    "_document_id": {
      "type": "string",
      "description": "A unique identifier for an audit event."
    },
    "emoji": {
      "type": "string"
    },
    "events": {
      "type": "array",
      "items": {
        "type": "object"
      }
    },
    "events_were": {
      "type": "array",
      "items": {
        "type": "object"
      }
    },
    "explanation": {
      "type": "string"
    },
    "fingerprint": {
      "type": "string"
    },
    "hook_id": {
      "type": "integer"
    },
    "limited_availability": {
      "type": "boolean"
    },
    "message": {
      "type": "string"
    },
    "name": {
      "type": "string"
    },
    "old_user": {
      "type": "string"
    },
    "openssh_public_key": {
      "type": "string"
    },
    "org": {
      "type": "string"
    },
    "previous_visibility": {
      "type": "string"
    },
    "read_only": {
      "type": "boolean"
    },
    "repo": {
      "type": "string",
      "description": "The name of the repository."
    },
    "repository": {
      "type": "string",
      "description": "The name of the repository."
    },
    "repository_public": {
      "type": "boolean"
    },
    "target_login": {
      "type": "string"
    },
    "team": {
      "type": "string"
    },
    "transport_protocol": {
      "type": "integer",
      "description": "The type of protocol (for example, HTTP or SSH) used to transfer Git data."
    },
    "transport_protocol_name": {
      "type": "string",
      "description": "A human readable name for the protocol (for example, HTTP or SSH) used to transfer Git data."
    },
    "user": {
      "type": "string",
      "description": "The user that was affected by the action performed (if available)."
    },
    "visibility": {
      "type": "string",
      "description": "The repository visibility, for example `public` or `private`."
    }
  }
}